ntopng is a network traffic probe that you operate entirely from a web browser. It comes from ntop, a small engineering company in Europe that grew out of the open source ntop project started in 1998, and its Community edition is released under the GPL v3. The ng suffix stands for next generation: when the first version appeared in June 2013, the company explained that after fifteen years it had chosen to rewrite the original tool from scratch rather than keep patching it.
Version 7.0, published on 22 September 2026 according to the project’s GitHub repository, replaced much of the interface with a Vue.js front end and added capabilities that go beyond plain monitoring, from Wazuh integration to BGP routing views.
What ntopng is for
The idea is to watch the traffic itself rather than rely on a device’s counters. ntopng captures packets on one or more interfaces, or receives sFlow, NetFlow and IPFIX records exported by routers through nProbe, the same company’s probe, and rebuilds the conversations between hosts. The nDPI library, also developed by ntop, names the application behind each flow, be it YouTube, a VPN, an SMB transfer or a DNS query, even when the port number reveals nothing. Everything lands in Redis, which must run on the same machine, and in a time series store of your choice, RRD, InfluxDB or ClickHouse.
The web interface, served over HTTPS on port 3001 by default, shows the busiest hosts, the dominant protocols, live flows, a geographic map of communications and, above all, alerts: thresholds exceeded, suspicious behaviour, contact with addresses on blocklists. Lua scripts extend those checks. Version 7.0 introduces sites, which group networks and exporters by location, a BGP looking glass with RPKI validation, OpenID Connect single sign-on, multi-factor authentication and passkeys.
The contrast with LibreNMS, a neighbour in the same category, comes down to the vantage point. LibreNMS polls devices over SNMP to track availability, interface load and hardware health, but it has no idea what travels inside the packets. ntopng looks at the content of the traffic, who talks to whom and with which application, and treats SNMP as a complement reserved for the Enterprise editions. The two tools complete each other more than they compete.
Four tiers are offered. Community, free and open source, is enough for a small network: the documentation suggests staying below 256 active local hosts and 8 monitored interfaces. Professional adds graphical reports, traffic profiles and LDAP or OIDC authentication. Enterprise M brings SNMP, advanced alert handling and nAnalyst, the AI-assisted analysis layer introduced in 7.0. Enterprise L adds fast ClickHouse export, a historical data explorer and user-to-traffic correlation, and XL to XXXL tiers raise the capacity ceilings.
Who is it for?
ntopng targets system and network administrators in small and medium businesses, schools, hosting companies and small carriers who want to know exactly what eats their bandwidth and spot a machine behaving oddly. It also suits security analysts who need a continuous view of traffic without deploying a full intrusion detection stack, and hobbyists curious about their home network on a Raspberry Pi.
The limits are real. Continuous capture on a busy link needs a properly sized processor and memory, and time series writes eventually fill a small disk, something the company itself points out for pfSense and OPNsense firewalls. The features large organisations value most are paid, and several of them are not available on Windows. For classic SNMP device monitoring LibreNMS remains the better fit, and for inspecting packets one by one Wireshark is still the reference.
Download ntopng safely
All official packages are published on packages.ntop.org. For Linux, ntop maintains stable repositories for Ubuntu 22.04 and 24.04, Debian 11 to 13, Rocky and AlmaLinux 8 to 10, plus packages for Raspberry Pi OS, and recommends Ubuntu Server LTS or Rocky Linux for production. A package for Apple Silicon Macs is available, unsigned, so the quarantine attribute has to be removed before installation, and Redis must be installed first through Homebrew. On Windows only a development build is distributed, as a zip archive, and Npcap has to be installed before running the installer. Official Docker images sit on Docker Hub, and development packages cover FreeBSD, OPNsense and pfSense.
The Community edition downloads and runs with no license and no registration. Pro and Enterprise editions are bought on shop.ntop.org as perpetual per-server licenses that include one year of updates, with the key tied to the machine’s system identifier. Prices are not listed in the documentation and depend on the edition. Any offer of a free Pro build or a license key shared on a third-party forum should be dismissed, as should packages that do not come from ntop’s repository or your distribution’s.
Frequently asked questions
Is ntopng free?
The Community edition is, under the GPL v3, and since version 7.0 it starts automatically when no license is present. Professional and Enterprise editions are paid, with a perpetual license that includes one year of updates. The Community source code is on GitHub.
How is it different from LibreNMS?
LibreNMS monitors devices over SNMP and reports on their health and port load. ntopng analyses the traffic itself, recognises applications and flags abnormal behaviour. Many teams run both side by side.
Do I need a dedicated server?
Not for a small network: a Raspberry Pi or a modest virtual machine copes with a few dozen hosts. For a busy link or long retention you need several cores, plenty of memory and above all disk space for the time series.
